poppler - Debian Package Tracker

general

source: poppler (main)
version: 22.02.0-3
maintainer: Debian freedesktop.org maintainers (archive) (DMD)
uploaders: Loic Minier [DMD] – Emilio Pozuelo Monfort [DMD] – Pino Toscano [DMD]
arch: all any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.48.0-2+deb9u2
o-o-sec: 0.48.0-2+deb9u4
oldstable: 0.71.0-5
stable: 20.09.0-3.1
testing: 22.02.0-3
unstable: 22.02.0-3

versioned links

0.48.0-2+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.48.0-2+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.71.0-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.09.0-3.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.02.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gir1.2-poppler-0.18
libpoppler-cpp-dev
libpoppler-cpp0v5
libpoppler-dev
libpoppler-glib-dev
libpoppler-glib-doc
libpoppler-glib8 (3 bugs: 1, 2, 0, 0)
libpoppler-private-dev (1 bugs: 0, 0, 1, 0)
libpoppler-qt5-1
libpoppler-qt5-dev
libpoppler118
poppler-utils (48 bugs: 0, 30, 18, 0)

action needed

Marked for autoremoval on 30 June due to nvidia-graphics-drivers-tesla-470: #1011146 high

Version 22.02.0-3 of poppler is marked for autoremoval from testing on Thu 30 Jun 2022. It depends (transitively) on nvidia-graphics-drivers-tesla-470, affected by #1011146. You should try to prevent the removal by fixing these RC bugs.

Created: 2022-05-24 Last update: 2022-05-25 21:09

A new upstream version is available: 22.05.0 high

A new upstream version 22.05.0 is available, you should consider packaging it.

Created: 2020-10-05 Last update: 2022-05-25 20:33

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2022-02-04 Last update: 2022-05-22 07:06

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Created: 2021-02-19 Last update: 2022-05-09 10:04

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Created: 2021-08-15 Last update: 2022-05-09 10:04

lintian reports 5 warnings high

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-09-21 Last update: 2022-01-01 04:34

17 bugs tagged patch in the BTS normal

The BTS contains patches fixing 17 bugs (18 if counting merged bugs), consider including or untagging them.

Created: 2021-08-14 Last update: 2022-05-25 21:02

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

libpoppler-glib-doc could be marked Multi-Arch: foreign

Created: 2017-12-07 Last update: 2022-05-25 21:12

12 low-priority security issues in buster low

There are 12 open security issues in buster.

2 issues left for the package maintainer to handle:

CVE-2020-27778: (postponed; to be fixed through a stable update) A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.
CVE-2022-27337: (needs triaging) A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

You can find information about how to handle these issues in the security team's documentation.

10 ignored issues:

CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
CVE-2019-9903: PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
CVE-2019-9959: The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
CVE-2018-18897: An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.
CVE-2018-19058: An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
CVE-2018-20650: A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
CVE-2019-10871: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.
CVE-2019-11026: FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
CVE-2019-14494: An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.

Created: 2021-02-19 Last update: 2022-05-09 10:04

3 low-priority security issues in bullseye low

There are 3 open security issues in bullseye.

1 issue left for the package maintainer to handle:

CVE-2022-27337: (needs triaging) A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

You can find information about how to handle this issue in the security team's documentation.

2 ignored issues:

CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

Created: 2021-08-14 Last update: 2022-05-09 10:04

Build log checks report 3 warnings low

Build log checks report 3 warnings

Created: 2017-10-26 Last update: 2021-01-21 22:05

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.6.0).

Created: 2022-05-11 Last update: 2022-05-11 23:24

news

[rss feed]

[2022-03-20] poppler 22.02.0-3 MIGRATED to testing (Debian testing watch)
[2022-03-17] Accepted poppler 22.02.0-3 (source) into unstable (Jeremy Bicha)
[2022-02-07] Accepted poppler 22.02.0-2 (source) into experimental (Jeremy Bicha)
[2022-02-05] Accepted poppler 22.02.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Jeremy Bicha)
[2021-11-06] Accepted poppler 21.11.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Sebastien Bacher)
[2021-06-21] Accepted poppler 21.06.1-1 (source) into experimental (Sebastien Bacher)
[2021-06-11] Accepted poppler 21.06.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Sebastien Bacher)
[2021-02-27] Accepted poppler 21.02.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Sebastien Bacher)
[2021-01-24] poppler 20.09.0-3.1 MIGRATED to testing (Debian testing watch)
[2021-01-21] Accepted poppler 20.09.0-3.1 (source) into unstable (Sebastien Bacher)
[2020-11-08] Accepted poppler 0.48.0-2+deb9u4 (source) into oldstable (Markus Koschany)
[2020-11-07] poppler 20.09.0-3 MIGRATED to testing (Debian testing watch)
[2020-11-03] Accepted poppler 20.09.0-3 (source) into unstable (Emilio Pozuelo Monfort)
[2020-09-07] poppler 20.09.0-2 MIGRATED to testing (Debian testing watch)
[2020-09-03] Accepted poppler 20.09.0-2 (source) into unstable (Emilio Pozuelo Monfort)
[2020-09-03] Accepted poppler 20.09.0-1 (source) into unstable (Emilio Pozuelo Monfort)
[2020-09-02] Accepted poppler 20.08.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Emilio Pozuelo Monfort)
[2020-08-20] poppler 0.85.0-2 MIGRATED to testing (Debian testing watch)
[2020-08-20] poppler 0.85.0-2 MIGRATED to testing (Debian testing watch)
[2020-08-18] Accepted poppler 0.85.0-2 (source) into unstable (Emilio Pozuelo Monfort)
[2020-07-23] Accepted poppler 0.48.0-2+deb9u3 (source) into oldstable (Emilio Pozuelo Monfort)
[2020-02-21] Accepted poppler 0.85.0-1 (source amd64 all) into experimental, experimental (Emilio Pozuelo Monfort)
[2019-10-18] Accepted poppler 0.26.5-2+deb8u13 (source amd64 all) into oldoldstable (Brian May)
[2019-10-17] Accepted poppler 0.26.5-2+deb8u12 (source amd64 all) into oldoldstable (Brian May)
[2019-10-12] Accepted poppler 0.81.0-1 (source amd64 all) into experimental, experimental (Emilio Pozuelo Monfort)
[2019-10-06] poppler 0.71.0-6 MIGRATED to testing (Debian testing watch)
[2019-10-04] Accepted poppler 0.71.0-6 (source) into unstable (Emilio Pozuelo Monfort)
[2019-09-30] Accepted poppler 0.26.5-2+deb8u11 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2019-06-06] Accepted poppler 0.26.5-2+deb8u10 (source amd64 all) into oldstable (Emilio Pozuelo Monfort)
[2019-05-30] poppler 0.71.0-5 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 126 132
RC: 1
I&N: 89 94
M&W: 36 37
F&P: 0
patch: 17 18

links

homepage
lintian (0, 5)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 22.02.0-3
98 bugs (5 patches)